The invention relates to the protection of the transfer of data between a videotex terminal and a server. This data concerns both access control to the server and the transmission of messages once the session is established. The invention applies to all videotex terminals, especially but not exclusively to those known under the French trade name "Minitel".
In order to control access to videotex systems faced with problems similar to those of remote data processing systems, three methods may be used. A first method is based on the recognition of an element familiar to the user and which is generally a password. However, this password is quite vulnerable to listenings and no standard terminal offers any protection against this threat. A second method is based on the recognition of an element concerning this individual, such as for example a biometric characteristic (voice, fingerprints). However, if such methods seem to be quite advantageous, they have up to now not been used owing to technical and economic reasons. A third method is finally based on the recognition of an element possessed by the individual. In this category, "smart" cards and authentication devices are the most reliable tools, since they implement a calculation algorithm enabling them to be fully identified. However, due to economic reasons, these systems do not seem to have met with the success hoped for.
The multi-services smart card requires the implementation of items of equipment which may be regarded as being complex and costly within the context of a single logical access control. In fact, this technique requires card readers to be connected to the videotex terminals for user cards, security processors for the cards of the server, and finally a dialogue software between a pairing (reader-card) on one side and a pairing (security processor-card) on the other side.
The authentication devices make it possible to reduce the cost of logical access control, but require the use of readouts and keyboards or optical sensors. Moreover, as there is no connection with the videotex terminal, the user is obliged to play the role of an interface between the authentication device and the terminal. Secondly, these devices generally use an off-line electric power supply, which renders their use even more complicated.
The present invention eliminates these drawbacks by proposing to protect access control to a server by authenticating the videotex terminal and protecting the messages exchanged between the server and the videotex terminal by means of using a straightforward device requiring no material adaptation to be made either to the terminal or the server and being less expensive than is currently the case.
The object of the invention is also to disconnect the videotex terminal in the event of any attempt to modify the data conveyed on the transmission line.
Another object of the invention is to use an additional package which can be directly plugged onto the video adapter connector of the videotex terminal without any autonomous power supply.
Another object of the invention is to allow for during the session protection, by means of encryption or by signature, of conveying of messages between this server and the videotex terminal so as to guarantee the confidentiality and/or integrity of these messages.
The invention also seeks to obtain a device whose characteristics make it possible to expand the development of videotex applications able to reach a very wide section of the general public (in terms of cost), whilst customizing the service.